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Call for Views: Code of Practice for the use of 1c0 
personal information in political campaigns ° 


Information Commissioner's Office 


The ICO’s new Code of Practice for the use of personal information in 
political campaigns will draw from our current Guidance on Political 
Campaigning, but will be fully updated to ensure it reflects the current 
Data Protection Act 2018 and GDPR requirements. It will also be widened 
to cover areas where our investigation found significant concerns or 
misunderstandings of the law. In addition, it will provide guidance and 
good practice recommendations to aid compliance. 


You can read the full background and legal basis for the production of this 
code on our website. 


Responses to this call for views must be received by 11.59pm on Friday 
21 December 2018 


If you would like further information on the call for views please 
telephone 0303 123 1113 and ask to speak to the Parliament and 
Government Affairs Department about the call for views on a new Code of 
Practice for the use of personal information in political campaigns or email 
politicalcampaigning@ico.org.uk. 


Privacy statement 

For this call for views we will publish responses received from 
organisations but will remove any personal data before publication. We 
will not publish responses from individuals. For more information about 
what we do with personal data please see our privacy notice. 


Call for Views: Code of Practice for the use of 
personal information in political campaigns 


Q1 Do you agree with our understanding of ‘political campaigning’ and 
what processing should be covered by the code? 


L ]ves 


No 


We do not agree with the proposed wording and believe that the definition used should be exactly the 
same as the amended definition of democratic engagement proposed in the Representation of the 
People Regulations 2001: 


The term “democratic engagement” is intended to cover a wide range of political activities inside and 
outside election periods, including but not limited to: democratic representation; communicating with 
electors and interested parties; surveying and opinion gathering, campaigning activities; activities to 
increase voter turnout; supporting the work of elected representatives, prospective candidates and official 
candidates; and fundraising to support any of these activities. 


Adopting this definition would ensure a basic level of consistency between the two sets of regulations, 
which must complement each other if they are to work effectively. 


The amended proposal is preferred as it clarifies that campaigning can take place both inside and outside 
of an election period and more accurately describes the types of activities that political parties undertake 


while campaigning. It is important that the guidelines acknowledge political campaigning activities do not 
simply start and stop at the beginning and end of an election period. Campaigning and democratic 
engagement activities are ongoing. Work on public engagement conducted outside of an election period 
lays the foundations for more inclusive and representative elections. Regular engagement with voters also 
ensures that parties develop policies and highlight issues that more accurately reflect the views of voters. 


It is important that the definition in the guidelines reflects the changing nature of British politics. Much of 
the campaign work political parties are currently undertaking on Brexit would not fall under the scope of 
the ICO’s suggested definition. 
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Q2 Should the code apply to other data controllers in the political 
campaigning process, beyond registered political parties, electoral 
candidates, referendum permitted participants and third party 
campaigners? E.g. data controllers processing personal data on behalf of 
political campaigns, parties or candidates. 


_ he 
[_] No 


Please explain further: 


Those providing personal data to political parties and those who are processing the data on behalf of 
political parties, it is important that the responsibility of compliance is shared equally between all 
companies and organisations supplying and processing data which will be used for political campaigning 
purposes. 


Q3 Who should the code also be aimed at ie data brokers, analytical 
companies, online platforms? (List as many as you think are applicable) 


Data brokers 

Analytical companies 

Social Media/ Online Platforms 

Press/media 

Advertising/marketing/market research companies 
Think Tanks 


Anyone providing a service to political parties which involves the processing of personal data 
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We propose the code will include the following broad topic areas: 

- The role of data controllers in the political campaigning ecosystem; 

- Transparency requirements in practice; 

- Accountability, security and data minimisation requirements; 

- Lawful bases including the new ‘democratic engagement’ aspect of the 
‘public interest’ 

basis in the Data Protection Act 2018; 

- Using special category data; 

- The use of personal data from the Electoral Register; 

- Data collection directly from individuals; 

- Using personal data collected by third parties; 

- Personal data analytics; 

- Direct marketing including the application of the Privacy and Electronic 
Communications 

Regulations; 

- Online advertising and the use of social media; 

- Post political campaign/election considerations. 


Q4 Do you agree with the proposed topics? 


L_lves 
[| No 


Please explain further: 


We are undecided as we feel that further clarification is needed on the following headings: 


- Transparency requirements in practice 
- Post political campaign/election considerations 


We have concerns that the topics have been devised on the assumption that political campaigns are one 
off events rather than part of the on-going activities of a political party (as per our answer to Q.1). 
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Q4c Is there anything we have not listed that ought to be included? 


H Yes 
L] No 


Please specify: 


Best practise for canvassing 

Guidance on distinguishing the roles of a councillor as a data controller in their own right and as a 
representative of their political party 

Guidance on auditing 


Q4b What topic areas in particular ought to be covered in the most detail? 


- Using special category data; 
- Lawful basis’ including the new ‘democratic engagement’ aspect of the ‘public interest’ 


- Data collection directly from individuals; (The use of Fair Processing Notices, collecting data during 
canvassing and recording consent in particular) 


- Using personal data collected by third parties 


- Personal data analytics 
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Q5 What do you think should be covered in the new code of practice that 
isn't covered in current political campaigning guidance? 


Social media campaigning and digital advertising 


Q6 What factors ought to be taken into account regarding the particular 
circumstances of different types of election or referenda? 


Unscheduled elections and referendums 

Data sharing between different organisations campaigning on the same side 

The redrawing of constituency boundaries - usually preparation needs to be undertaken before 
the new constituency legally exists 
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Q7 Please state any case studies or scenarios you would like to see 
included in the code? 


Using third party suppliers of data 
Canvassing door to door 
Organisations campaigning on the same side under an umbrella 


Trade Unions 
Electoral pacts 


Q8 Please state any examples of guidance, tools or good practice you 
have encountered that could aid compliance in this area, and could be 
included in the code. 
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Q9 Name and contact details: 


Q10 Are you responding: 
[_] In your own capacity? 
Ml On behalf of an organisation 


Please describe your role and your organisation: 


PS Liberal Democrats 


